I have the following simplified version of the query where for each caller, I need all_calls (from sourcetype=x) and messagebank_calls (from sourcetype=y). index=sample1 sourcetype=x host=host1
| stats values(caller) as caller by callid
| stats count as all_calls by caller
| rename caller as caller_party
| appendcols
[ search index=sample1 AND sourcetype=y
| stats count as messagebank_calls by caller_party]
| search all_calls=* messagebank_calls value is incorrect and I'm guessing because of the subsearch/appendcols? How do I increase the limit or re-write so I can get the same results caller, all_calls, messagebank_calls?
... View more